American University Washington College of Law Digital Commons @ American University Washington College of Law Articles in Law Reviews & Other Academic Journals Scholarship & Research 1995 A Puzzle Even the Codebreakers Have Trouble Solving: A Clash of Interests over the Electronic Encryption Standard Sean Flynn Follow this and additional works at: https://digitalcommons.wcl.american.edu/facsch_lawrev Part of the Communications Law Commons, Computer Law Commons, International Trade Law Commons, Internet Law Commons, and the Science and Technology Law Commons A PUZZLE EVEN THE CODEBREAKERS HAVE TROUBLE SOLVING: A CLASH OF INTERESTS OVER THE ELECTRONIC ENCRYPTION STANDARD SEAN M. FLYNN* I. INTRODUCTION On February 9, 1994, when the National Institute of Standards and Technology (NIST) announced the federal Escrowed Encryption Stan- dard (EES),' the simmering debate over encryption policy in the United States boiled over. Public interest groups argued that the standard would jeopardize an individual's right to privacy. U.S. multinationals voiced concerns that the government would undercut private encryption technology and limit their choice of encryption products for sensitive transmissions. Computer software groups claimed that EES lacked commercial appeal and would adversely affect their ability to compete. Pitted against these concerns were those of the law enforcement and national security communities, which countered that the interests of national security required the adoption of EES. A quick study2 of EES reveals little that would explain this uproar. The NIST issued EES as an encryption methodology for use in its government information processing 3 pursuant to the Computer Secu- rity Act of 1987. 4 The EES is intended to supersede the existing government standard, Data Encryption Standard (DES), which has been in use since 1977 and is very popular. 5 The new standard's methodology is classified, but the government has stated that it represents the state of the art in security protection. The catch in this positive scenario is that the government keeps a backdoor key that will allow it to decrypt encrypted messages. So why did an obscure and seemingly insignificant announcement cause so much commotion? Upon closer examination, one discovers that * B.A., Duke University, 1990;J.D., Georgetown University Law Center, anticipated 1996. 1. Approval of Federal Information Processing Standards Publication 185, Escrowed Encryp- tion Standard (EES), 59 Fed. Reg. 5997 (1994) [hereinafter Approval of EES]. 2. The specifics of the EES are examined in greater detail in Part II.C. 3. Approval of EES, 59 Fed. Reg. at 5998. 4. 15 U.S.C. § 278g-3(a)(5) (1994). 5. OFFICE OF TECHNOLOGY ASSESSMENT, INFORMATION SECURITY AND PRIVACY IN NETWORK ENVIRONMENTS 121-22 (1994). LAW & POLICY IN INTERNATIONAL BUSINESS encryption, though still obscure to many, is a hot commodity in the information age. It is the silver shield that protects personal, financial, trade, and national security information. And, until recently, the govern- ment has enjoyed a monopoly over its development and use. Viewed from this perspective, the NIST announcement was seen by many as a government attempt to maintain its monopoly to the detriment of potential users and private developers. The ensuing clash of interests has created an impasse. Encryption users and privacy advocates refuse to accept the government's EES standard. For its part, the government maintains stringent export controls to undermine the development of feasible alternative standards and to deny software producers economies of scale. This Note will undertake a number of examinations. First, it will review the government's role in cryptography. Second, it will study EES in detail. Third, it will explore how the EES scheme works with other aspects of the government's encryption policies to trigger legal, eco- nomic, and political concerns. Fourth, it will survey the alternatives to EES. Finally, it will suggest how the interests in the current policy debate may achieve an accommodation that would sufficiently address privacy and competitiveness concerns, on the one hand, while meeting national security and law enforcement concerns on the other. II. A QUICK CRYPTOGRAPHY PRIMER A. Wat is C0yptography? Before proceeding further into this complex area, it may be useful to go over some fundamentals. At its base, cryptography is the practice of transforming a message into gibberish (encryption), transmitting it, and transforming it back into "plaintext" (decryption) at the other end.6 Though once the province of spies, diplomats, and generals as a device to protect sensitive communications, encryption has moved gradually into the mainstream. With the increasing prevalence of networked computing7 and its increasing vulnerability to tamper- 6. See, e.g., BRUCE SCHNEIER, APPLIED CRYPTOGRAPHY 1-2 (1994). 7. Andrew Johnson Laird, President of Johnson-Laird, Inc., estimated that there are more than 3.2 million "host" computers on the Internet as of July 1994, an increase of 81% from the previous year. AndrewJohnson Laird, Exploring Cyberspace: The Good, The Bad, and The Ugly, in 8th Ann. Advanced Computer L. Inst. 390 (Mar. 23-24, 1995) (unpublished manuscript, reproduced by Continuing Legal Education Division of Georgetown University Law Center) (on file with Law andPolicy in InternationalBusiness). Estimates of the number of Internet users range from 2 million to 25 million. Id. at 391. If electronic money were to become legal tender on the Internet, it would [Vol. 27 ELECTRONIC ENCRYPTION STANDARD ing," cryptography has become a valued tool both for businesses and consumers in the protection of proprietary and personal information. Properly employed, cryptography can perform three distinct func- tions: (1) authenticate the sender by means of a unique "signature"; (2) protect the confidentiality of the message during transmission and in storage; and (3) assure the integrity of the message through encrypting a digest.9 In general, the method by which the message is transformed into and out of gibberish is the "algorithm." Each particular encryption is achieved by plugging a string of numbers, or a "key," into the algorithm and then applying the result to the message. Decryption works by running the encrypted message back through the algorithm- key combination.' The strength of a cryptographic system is gauged by the length of its key and the complexity of its algorithm.' key; the sender Traditionally, cryptographic schemes used a single 2 encrypted and the receiver decrypted the message with the same key.' This system has an inherent weakness: the key must necessarily be distributed to all communicants; the more widely distributed the key, the more likely the possibility that it could fall into the wrong hands. In response to this problem, two researchers at Stanford University created a two-key scheme called "public key."' 13 In a public key system, one key, which is posted publicly, encrypts the message; the second key, which is kept secret, decrypts it. Although the keys are mathematically related, each functions in only one direction and, thus, both are needed to complete the encryption-decryption chain of events. 14 Since public key algorithms are cumbersome to calculate, it would be inconvenient to use them for the entire message. In practice, parties use public key schemes produce a "virtual economy" as large as that of the Netherlands. Electronic Money: So Much for the Cashless Society, ECONOMIST, Nov. 26, 1994, at 21, 22. 8. Illicit and widespread activities on the Internet include copyright and trademark infringe- ment, theft of trade secrets, software pirating, harassment, and unauthorized entry onto systems by hackers. Laird, supra note 7, at 411-20. 9. OFFICE OF TECHNOLOGY ASSESSMENT, supra note 5, at 39. 10. SCHNEIER, SUpra note 6, at 1-2. 11.Id. at 129. 12. Id. at 3. 13. Whitfield Diffie, a mathematician and computer scientist, and Martin E. Hellman, a professor of electrical engineering, created the public key scheme at Stanford University and published their findings in 1976. Steven Levy, The Cypherpunks vs. Uncle Sam, N.Y. TIMES,June 12, 1994, Sec. 6, at 47-48. Shortly after the researchers published their findings, three mathematicians at M.I.T.-Ronald L. Rivest, Adi Shamir, and Leonard M. Adleman-implemented a public key system of encryption, which became known by their initials, RSA. Id. at 48. 14. SCHNEIER, supra note 6, at 29-30. 1995] LAW & POLICY IN INTERNATIONAL BUSINESS to exchange a session key and a single-key algorithm. 15 Thus, public key facilitates on the spot creation and secure distribution of the unique session key. B. The Federal Government's Preeminent Role in Cryptography It is a testament to both the importance and complexity of cryptogra- phy that the National Security Agency (NSA), 16 a part of the Depart- ment of Defense, has until recently been the sole source of advanced cryptographic know-how in the United States.17 The NSA has two national missions: to collect foreign signals intelligence and to provide secure information systems to protect classified and unclassified govern- ment information and communication. 8 Thus, the government is not only a developer of cryptography technology, it is a user and a regulator of encryption products as well. These multiple roles give the government varying levels of insight into cryptography in the United States. In its roles as regulator and user, the government is able to monitor the current state of encryption technology. In its roles as developer and federal standard-setter, the government is able to influence the develop- ment of cryptography in this country.' 9 If all of these functions were properly coordinated, the potential would exist for the government to impose its own standards on the marketplace while discouraging other 2 0 This potential is one of the reasons that government standards. 2 processing standards are not mandated for government agencies. 1 15. Id. at 30-31. 16. The NSA was created by a presidential memorandum on October 24, 1952 to monitor and decode transmissions considered relevant to national security.